Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 23:45
Behavioral task
behavioral1
Sample
2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe
-
Size
145KB
-
MD5
89a181fac77cc6e784fda5672569d09d
-
SHA1
7aaff3836b3e4118e17b526cebcd9c2676c7c44d
-
SHA256
ccc0cdfa2dde9635fd97145c3d946365a8019c5c36b176abf492a50a8f5bb28c
-
SHA512
703fa4c64719576d8186b9cdf8f3fc5b5050eb9c668edc7cc55eded223e6492f573b7fe1086a19f8379f3848feab3b03b8d4ff22892892b35142a4eb221c3532
-
SSDEEP
3072:HqJogYkcSNm9V7D3IRoErzLH72lBQuW2T:Hq2kc4m9tD3IaMSBV
Score
9/10
Malware Config
Signatures
-
Renames multiple (324) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself 1 IoCs
pid Process 1652 223.tmp -
Executes dropped EXE 1 IoCs
pid Process 1652 223.tmp -
Loads dropped DLL 1 IoCs
pid Process 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1652 223.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp 1652 223.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeDebugPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: 36 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeImpersonatePrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeIncBasePriorityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeIncreaseQuotaPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: 33 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeManageVolumePrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeProfSingleProcessPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeRestorePrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSystemProfilePrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeTakeOwnershipPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeShutdownPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeDebugPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeBackupPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe Token: SeSecurityPrivilege 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2640 wrote to memory of 1652 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 32 PID 2640 wrote to memory of 1652 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 32 PID 2640 wrote to memory of 1652 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 32 PID 2640 wrote to memory of 1652 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 32 PID 2640 wrote to memory of 1652 2640 2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe 32 PID 1652 wrote to memory of 916 1652 223.tmp 33 PID 1652 wrote to memory of 916 1652 223.tmp 33 PID 1652 wrote to memory of 916 1652 223.tmp 33 PID 1652 wrote to memory of 916 1652 223.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_89a181fac77cc6e784fda5672569d09d_darkside.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\ProgramData\223.tmp"C:\ProgramData\223.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\223.tmp >> NUL3⤵PID:916
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:2424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD54273e2fd044bb56673097dbe1da8444b
SHA1ad92d29ccc6aeeb3a9692d3a3920db862dbd7cd2
SHA2569a44e98a3af5b7a9a682ba647d477fa1237121b92fc4ffde681694cf8ee21f3a
SHA512d76b31bdd9dde550efebb0d4fc6dcce417408bcecf891f4548dc366da03257f97783dc1324740a7260c56f9d9cc2da137614b8d823b2e90818de53bd784af891
-
Filesize
145KB
MD517885b44b3f5d9f717f75181d7574705
SHA10669e4bf7c36ad8d1477e89ea42e74e4ff1a0faf
SHA2568d06deb8b5116f911be326d97a9cce25725e8eff47a76c77927a13831a05a353
SHA5124aad24c73eb4a0d21d29cc41447a6fa03dd8f82b1ef5a1c0959118fa33fd67ed4b9180aec421e22a792db3c8be5be3be8da71e287ad845fa9e29565c89c5ff55
-
Filesize
316B
MD5edb4a1b4a50aea3eb796727e1c2201e9
SHA114a3c5ab8c285fdeba07a39203a3920a1dad83ea
SHA256ab7291eb5827231cfcc8b1877bf7e13489e705662169931bab08bbe8a03c6843
SHA5121b9f241e930669edbc6731ee69b84e2c0d7ae5fceed0adc790be8ae3d1723f80dda7e0b0d584ec4cf12c5ad7a77c1a8756312f213c90a8766085e5892af83ad3
-
Filesize
129B
MD54bd56f1564a3529a81c90c887e0e6d26
SHA121e4eaa01005dc16b80761c2f2a03eb2a480d987
SHA256b793bf79d552733685c429439ffbcbfaff1d98cd9dbe82c7c70bec3cdd548199
SHA512713d186726fb766ec679eae6dfef8a44605a362b01464df640972e6745d24320f6ba7e951e2cd2fb2005f35af3b76a0997360ee2a8261caf32718e9327c30be4
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf